The objects you're looking for are [UserEntityAccess][1] and [UserFieldAccess][2], for object security and field security, respectively. Unfortunately, it appears that these tables are read-only, so you're still stuck with using the Metadata API, as far as I can tell.


  [1]: https://developer.salesforce.com/docs/atlas.en-us.api_tooling.meta/api_tooling/tooling_api_objects_userentityaccess.htm
  [2]: https://developer.salesforce.com/docs/atlas.en-us.api_tooling.meta/api_tooling/tooling_api_objects_userfieldaccess.htm